Connectivity And Security

A security administrator is investigating a suspected data exfiltration incident. The administrator needs to identify which user account uploaded a large file to an external cloud storage service. Which log type should the administrator examine to find the username associated with the upload?

A network administrator is troubleshooting a Palo Alto Networks firewall and needs to verify which security policy rule is allowing or denying a specific session. The administrator wants to see the rule name and the action taken for a particular flow. Which CLI command should be used?

Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?

Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?

Which THREE components are involved in configuring an IKE Gateway for a VPN?

A security administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator wants to ensure that the VPN tunnel is established and that traffic is routed correctly. Which interface type should be used for the tunnel interface to allow dynamic routing protocols to run over the VPN?

Which THREE criteria can be used to define a security policy for granular control?

An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?

Which THREE tasks are performed by the Dataplane during traffic processing?

When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?

An administrator notices that a firewall is not blocking traffic that matches a security profile group configured with anti-spyware and vulnerability protection. The traffic log shows the session is allowed, but no threat logs are generated. What is the most likely cause?

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?

Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?

Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?

Which object type allows you to group multiple IP addresses into a single entity for use in security policies?

An engineer is deploying a new Palo Alto Networks firewall and needs to enable DNS sinkholing for malware command-and-control domains. The firewall must respond to internal clients with a sinkhole IP address when they query known malicious domains. Which configuration step is required to make the firewall perform DNS sinkholing?

A security administrator is troubleshooting why a user's GlobalProtect connection is failing. The user can authenticate successfully, but the GlobalProtect client shows 'Connected' yet cannot access internal resources. The administrator checks the GlobalProtect Gateway configuration and sees that the tunnel interface is configured with an IP address and the client IP pool is set. What is the most likely cause of the issue?

What is the result of having two security policies with the same source, destination, and service, but different applications?

A network security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall performs application identification and applies security profiles to the traffic. The traffic is currently being allowed by a security policy, but no security profiles are being applied. What is the most likely cause?

A security administrator is configuring a Site-to-Site VPN with a partner organization. The partner uses a policy-based VPN, while your organization uses a route-based VPN with a tunnel interface. The tunnel is up, but traffic is not passing. The administrator confirms that the proxy IDs match on both sides. What is the most likely cause of the issue?

A network engineer is setting up a new Security Zone on a Palo Alto Networks firewall. The engineer wants to ensure that traffic entering this zone from any other zone is denied by default. Which action should be taken?

A network administrator is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The administrator notices that the VPN tunnel is up, but traffic is not passing through it. The administrator checks the routing table and sees that the route to the remote network is pointing to the tunnel interface. What is the most likely reason for the traffic not passing?

A security engineer is configuring GlobalProtect on a Palo Alto Networks firewall. The engineer wants to ensure that users are authenticated before they can access internal resources. The engineer has configured the GlobalProtect portal and gateway, but users are able to connect without providing credentials. What is the most likely cause?

An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?

An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?

An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?

Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?

An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?

A network administrator is deploying a new Palo Alto Networks firewall in a data center. The security policy requires that all traffic to the DMZ be inspected for threats, but the administrator wants to ensure that SSL encrypted traffic is decrypted and inspected without breaking applications that use certificate pinning. Which feature should the administrator configure to selectively decrypt traffic based on the destination URL category?

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?